Bug 2535291 (CVE-2026-89851)

Summary: CVE-2026-89851 kernel: scsi: qla2xxx: Fix FCE trace enable parsing in debugfs
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's `qla2xxx` SCSI driver. An issue in the `qla2x00_dfs_fce_write()` function, responsible for parsing Fibre Channel over Ethernet (FCE) trace enable settings in debugfs, could lead to a null pointer dereference. A local attacker with access to debugfs could trigger this flaw, causing a kernel panic and system crash. Additionally, incorrect handling of return values could inadvertently enable FCE tracing.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-16 11:53:30 UTC 
In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix FCE trace enable parsing in debugfs

qla2x00_dfs_fce_write() called kstrtoul() with a NULL result pointer,
so a successful parse would dereference NULL and oops. Worse, the int
return value (0 on success, negative errno on failure) was assigned to
the unsigned long enable flag, inverting the intended logic: a valid
number was treated as "disable" while a parse failure enabled FCE.

Parse the value into enable and propagate parse errors to userspace.
Comment 1 Mauro Matteo Cascella 2026-09-22 14:57:45 UTC 
Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89851.mbox